With a database system having multiple systems such as a main system and a sub system, such that a database is redundant, a user needs to judge switchover of systems and manually switch systems over in the event that there is no device to perform arbitration of the systems. A device which performs arbitration of the systems is called an “arbitrating device”.
On the other hand, with a database system having an arbitrating device, the user visually confirms that the main system database is stopped before switching systems, since there may be network failure between the arbitrating device and the databases of the systems, or the database itself may be busy.
There are known database reconfiguration devices relating to the above art, which enable transition to a database without dependency on a database management method and without practically stopping online services (e.g., Japanese Unexamined Patent Application Publication No. 2007-041888).
Also, there are known database systems which, in the event that the database device of the main center becomes unusable, speedily perform work to switch to operations at the database device a sub center, and following restoration return operations to the database device of the main center without copying all records (e.g., Japanese Unexamined Patent Application Publication No. 2007-293821).
With a database system in which the database is redundant over multiple systems, and each system independently has a storage medium for storing the database, a situation wherein databases at multiple systems are capable of being updated at the same time when the main system or sub system goes down needs to be prevented. A state wherein databases at multiple systems are capable of being updated at the same time is called a “split-brain state”.
In this case, the main system and sub system need to monitor each other and each decide state transition for itself in accordance with the change in state of the other. However, there has been a problem in that, in the event that there is an abnormality in a path between systems communicably connecting the main system and sub system, each system cannot detect the change in state of the other, meaning that each system is incapable of deciding state transition of itself.
Using an arbitrating device to perform arbitration between the systems has been conceived to solve this problem.
FIG. 1 is a diagram illustrating a database system 100 including a first database server 101 and database 102 making up a main system, a second database server 103 and database 104 making up of sub system, and an arbitrating device 105 for performing arbitration regarding the states of the systems. The numbers (1) through (6) in FIG. 1 correspond to the following descriptions (1) through (6).
The first database server 101 manages and controls the database 102. For example, the first database server 101 manages and controls the state and so forth of the system of the database 102. In the same way, the second database server 103 manages and controls the database 104. For example, the second database server 103 manages and controls the state and so forth of the system of the database 104.
Also, the first database server 101 and second database server 103 have an update inhibition flag to be used to control updating of databases. In the event that the update inhibition flag is set to “valid”, updating of the database is inhibited. Also, in the event that “invalid” is set for the update inhibition flag, the database can be updated.
In FIG. 1, the first database server 101 is the main system, so the update inhibition flag is set to “invalid”. Also, the second database server 103 is the sub system, so the update inhibition flag is set to “valid”.
(1) Let us consider a case where, for example, trouble occurs on the network communicably connecting the first database server 101 and the second database server 103, such as line breakage, and the first database server 101 and the second database server 103 are in an incommunicable state with each other.
(2) In this case, upon detecting that the first database server 101 and the second database server 103 are in an incommunicable state with each other, the second database server 103 makes a state transition query to the arbitrating device 105.
(3) In response, the arbitrating device 105 gives a stop instruction to the first database server 101.
(4) At the same time, the arbitrating device 105 gives a promoted main system instruction to the second database server 103, to switch over from sub system to main system.
(5) Upon receiving the promoted main system instruction, the second database server 103 changes the update inhibition flag from “valid” to “invalid”. Subsequently, the second database server 103 takes over for the first database server 101 and operates as the main system.
(6) Now, in order for the second database server 103 to take over for the first database server 101 and operate as the main system, the first database server 101 operating as the main system needs to be in a stopped state, i.e., the update inhibition flag needs to be set to “valid”. However, if the first database server 101 does not stop operations before the second database server 103 takes over for the first database server 101 and starts operating as the main system, the main system and sub system will be in a split brain state. Thus, there is a problem in that there are cases wherein a split brain state cannot be prevented.